Sales Order (Processing Services)

Transcription

1 SO# DIRECT CUST# INDIRECT CUST# Sales Order (Processing Services) Note: RelayHealth will assign CUST# s and SO# will be completed upon receipt. Sold To ( End User ): Bill To: Note: cannot be a P.O. Box for Sold To Contact: Telephone: Facsimile: PROCESSING SERVICES Description Category Family Unit Price Qty. (Monthly) Net Price Electronic Claims Services TSH $ 0.25 per claim $ Paper Claims Services TSH $ 0.25 per claim $ Payor Direct Handling Fee Services TSH $ per claim $ Electronic Remittance Advice Services TSH $ 0.20 per transaction $ Statements Services TSH $ n/a per transaction $ Fast Forward Services TSH $ n/a per transaction $ Payment Terms: Net 30 Days Estimated Monthly Processing Service Total: $ GENERAL COMMENTS Print Image Claims. Claims that are processed and found to contain errors that would ultimately cause rejection at the payor are formatted into a print image and returned to the customer via their mailbox. These claims are excluded from transmission to the payor. If print image claims are created and End User has not contracted for a print image claim rate, the claims will be billed at RelayHealth s then-current rate. Paper Claims: Cost for this service is the rate for the paper claim, plus postage. Selection for this service is indicated during registration. Statement Processing includes the following: statement forms, outside envelopes, return envelopes, laser printing, bursting, folding, inserting, Postnet bar coding, postage. AUTHORIZATION End User Signature: Printed Name: Title/Position: Date: RelayHealth Signature: Printed Name: Title/Position: Date: Oceris, Inc / Page 1 of RelayHealth End User Sales Orders

2 RELAYHEALTH S PROCESSING SERVICES Attachment to Sales Order No. 1. DEFINITIONS: 1.1 "Prevailing Rates" means the applicable RelayHealth standard rates in effect, for the Processing Service(s), on the date that the Processing Service(s)is provided. 1.2 "Processing Services" means such services as are provided by RelayHealth to End User pursuant to Section Payor as used in Section 7, means the person or entity with whom End User designates its particular Transaction to be filed or submitted as stated in a list provided to RelayHealth and to which RelayHealth agrees to submit such Transaction. 1.4 "Transaction," as used in Section 7, means information received from End User or its agent that is processed by RelayHealth as a distinct claim, inquiry, information request, statement, or other item. 2. TERM: The initial term of this Sales Order will commence on the date RelayHealth signs above and will continue for a period of three years thereafter, unless earlier terminated as provided herein. The term will automatically renew for additional oneyear terms, unless either party gives written notice to the other party at least 90 days prior to the expiration of the then-current term of its decision not to renew. End User agrees that RelayHealth will be the preferred supplier to End User for the Processing Services during the term. 3. RESPONSIBILITIES: Subject to Section 5 and 6, during the term, RelayHealth will process the Transactions listed in this Sales Order upon timely receipt of properly entered, formatted and coded data files, documents, balancing totals or other required information from End User, as applicable. End User or its agents will deliver accurate and complete electronic encoding of Transaction data to RelayHealth in RelayHealth s standard acceptable medium and common format, as designated by RelayHealth. End User represents that it has complied with all applicable laws and regulations (including any confidentiality requirements) and obtained the proper authorizations, if any, required by law to permit RelayHealth to provide the Processing Services. End User is solely responsible for the accuracy and integrity of all information provided by End User to RelayHealth, and RelayHealth will have no obligation to verify, check, inspect or correct information supplied by End User to RelayHealth, except to verify the number of records, the number of Transactions, and the total dollar amount of Transactions actually received and processed by RelayHealth. At End User s expense, End User will maintain all source documents for verification of Transaction data. RelayHealth will not be responsible for record keeping or security backup of any Transaction information, or for loss of data. Transactions rejected by a Payor or by RelayHealth for any cause not attributable to fault by RelayHealth must be corrected and resubmitted by End User at End User s expense. 4. FEES: Processing Services fees will be invoiced to End User monthly beginning with RelayHealth s processing of End User s actual Transactions. End User s Processing Services fees will be based upon the monthly Transactions as specified for each Transaction listed in this Sales Order. The Prevailing Rates for Processing Services set forth in this Sales Order are valid during the calendar year of the Effective Date. Except as set forth in the next sentence, RelayHealth may, effective as of January 1 of each year thereafter, increase the Prevailing Rates for Processing Services. The amount of such increase will not exceed five percent. RelayHealth may at any time increase its transaction rates for paper transactions, including, without limitation, paper insurance claims, by an amount equal to RelayHealth s increased cost and incremental profit margin per transaction for forms, envelopes, and other paper related supplies. Processing fees include the cost of all forms used at RelayHealth s processing center except for custom End User forms and letterheads. End User shall pay or reimburse RelayHealth for all reasonable and actual fees and charges imposed by any Payor or entity related to filing transactions, network surcharges, and all telecommunications costs, shipping costs, and postage costs. 5. MODIFICATION: RelayHealth reserves the right to discontinue or modify any Transaction listed in this Sales Order that may be performed by RelayHealth during the term, if such Transaction becomes obsolete or commercially impractical as a result of industry practice or the effect or implementation of any local, state or federal law or regulation. End User acknowledges that future changes in paper Transactions or in a Payor s information or format requirements may require RelayHealth or End User to generate additional or different information, to use different formats, to reprogram software, and/or to incur delays in processing Transactions. Accordingly, End User and RelayHealth agree that this Sales Order shall be amended as is reasonably necessary to accommodate said changes, and that each party shall bear its own costs related to said changes, provided that if any change relates to a particular Payor and involves an unreasonable cost to either party, such party may discontinue Processing Services with respect to such Payor upon notice to the other party. 6. TERMINATION: RelayHealth reserves the right to (i) suspend provision of Processing Services because of nonpayment of sums owed to RelayHealth that are undisputed and 60 days or more past due. End User At the completion of the final month s processing and all deconversion activities, any additional processing fees or charges will be invoiced to End User. Oceris, Inc / Page 2 of RelayHealth End User Sales Orders

3 7. TRANSACTION TYPES: 7.1 Electronic Claims Transactions. RelayHealth will process and submit End User s Transactions directly to the appropriate Payor via electronic transmission or other appropriate medium, in lieu of processing paper Transactions under Section 7.2, provided such Payor or designated intermediary agrees to accept End User s Electronic Transactions when submitted by RelayHealth. 7.2 Paper Claims Transactions. Transactions not covered by Paragraph 7.1 will be processed and printed on paper by RelayHealth using the standard HCFA 1500, UB-92, or other appropriate form. RelayHealth will send processed paper Transactions to End User, unless RelayHealth, End User and End User s Payor(s) have agreed for RelayHealth to send such Transactions directly to End User s Payor(s). 7.3 Electronic Remittance Advice. RelayHealth will process and generate Electronic Remittance Advice for payors listed on RelayHealth s Electronic Remittance Advise Payor list. RelayHealth will only provide Electronic Remittance for payors where we get the claims electronically directly from End User. 7.4 Patient Statements and Collection Letters. RelayHealth will process and mail End User s electronic patient statement and collections letter files directly to the patient. 7.5 Real-Time Eligibility Transactions Enrollment. Access to any payor s data is controlled by the payor and shall only be made available to providers which are enrolled (if necessary) with the payor. RelayHealth will identify and specify the payor enrollment process where necessary and provide required forms to Customer. Customer shall ensure completion of the forms and shall have them signed by the provider when required. Customer shall return all forms to RelayHealth Provider Numbers. Customer shall not insert provider numbers into Real-Time Eligibility Transactions, nor shall Customer knowingly allow a Transaction to contain a provider number that does not belong to the Provider submitting the Transaction Payor Contracts. Customer acknowledges that access to any given payor s data is normally dependent on a contract between RelayHealth or RelayHealth s business partner and the payor. Such a contract may be canceled, terminated for cause, or may expire on some given date in the future. RelayHealth shall use reasonable efforts to provide advance notification to Customer of anticipated contract terminations. Should any of these events happen, RelayHealth bears no liability for its inability to provide Real-Time Eligibility Transaction Services to Customer Customer Responsibilities. Customer will be responsible for maintaining the correct technical infrastructure to support Real-Time Eligibility Transactions, including operation on the current OS release and HIS release. Before Customer or a Provider submits any 270s to RelayHealth and at all times thereafter, Customer will ensure that each Provider provides sufficient security measures, including user ID and passwords, to associate a particular 270 with the particular employee who submitted the 270, with respect to all 270s that it submits to RelayHealth. Customer will cooperate with RelayHealth or its agents in the event that RelayHealth has a security concern with respect to any 270 submitted by Customer or a Provider to RelayHealth. Customer will immediately notify RelayHealth in the event any of the assurances in this paragraph provided are no longer met. Customer will immediately cease 8. BREACH: In the event that End User is responsible for terminating this Sales Order with respect to Processing Services in any manner other than is permitted herein, End User agrees to pay RelayHealth 80% of the total monthly estimated Processing Services fees listed in this Sales Order multiplied by the number of months remaining in the term as liquidated damages. End User agrees that the measure of damages set forth in this Section 8 is fair and reasonable under all facts and circumstances, and that this Section 8 will not be construed as a waiver or limitation of RelayHealth s right to recover any other debt or damages that may be owed to RelayHealth under this Sales Order or any other agreement. 9. PROCESSING SERVICES DISCLAIMER. DUE TO THE NATURE OF THE PROCESSING SERVICES, END USER ACKNOWLEDGES AND AGREES THAT IN NO EVENT WILL RELAYHEALTH BE LIABLE FOR (A) ANY LOSS, DAMAGE, COST OR EXPENSE ARISING FROM THE INACCURACY, INVALIDITY, INCOMPLETENESS, ERROR, OMISSION, MISDELIVERY, OR OTHER FAULT OF END USER, ANY PAYOR, OR ANY THIRD PARTY AND RELATING TO ANY INFORMATION OR TRANSACTION PROVIDED TO OR PROCESSED BY RELAYHEALTH, (B) ANY REIMBURSEMENT DECISIONS BY PAYORS WITH RESPECT TO THE PROCESSING SERVICES; OR (C) ANY CLAIM, LOSS CORRECTION, DAMAGE OR EXPENSE CAUSED BY RELAYHEALTH S PERFORMANCE OF THE PROCESSING SERVICES OR FAILURE TO PERFORM SUCH PROCESSING SERVICES WHICH IS NOT REPORTED WITHIN 12 MONTHS OF SUCH PERFORMANCE OR FAILURE TO PERFORM. Oceris, Inc / Page 3 of RelayHealth End User Sales Orders

4 10. LIMITATION OF LIABILITY Total Damages. RELAYHEALTH S TOTAL CUMULATIVE LIABILITY UNDER, IN CONNECTION WITH, OR RELATED TO THIS WILL BE LIMITED TO THE TOTAL FEES PAID (LESS ANY REFUNDS OR CREDITS) BY END USER TO RELAYHEALTH UNDER THIS SALES ORDER FOR THE PRODUCT OR SERVICE GIVING RISE TO THE CLAIM DURING THE 12-MONTH PERIOD PRECEDING THE DATE OF THE CLAIM, WHETHER BASED ON BREACH OF CONTRACT, WARRANTY, TORT, PRODUCT LIABILITY, OR OTHERWISE Exclusion of Damages. IN NO EVENT WILL RELAYHEALTH BE LIABLE TO END USER UNDER, IN CONNECTION WITH, OR RELATED TO THIS SALES ORDER FOR ANY SPECIAL, INCIDENTAL, INDIRECT, OR CONSEQUENTIAL DAMAGES, INCLUDING, BUT NOT LIMITED TO, LOST PROFITS OR LOSS OF GOODWILL, WHETHER BASED ON BREACH OF CONTRACT, WARRANTY, TORT, PRODUCT LIABILITY, OR OTHERWISE, AND WHETHER OR NOT RELAYHEALTH HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE Material Consideration. THE PARTIES ACKNOWLEDGE THAT THE FOREGOING LIMITATIONS ARE A MATERIAL CONDITION FOR THEIR ENTRY INTO THIS SALES ORDER. 11. HIPAA: 11.1 Transaction Standards. RelayHealth warrants that the format for Transactions purchased by End User that are regulated by HIPAA will follow the HIPAA required formats as defined in the Transactions and Codes Sets Final Rule and the associated Implementation Guides from X12N as adopted by the Secretary of Health and Human Services Data. Notwithstanding anything to the contrary in any Business Associate Agreement between the parties or elsewhere in this Sales Order, End User authorizes RelayHealth to (a) de-identify PHI in accordance with 45 C.F.R (b) or (b) perform Data Aggregation (as defined in those regulations relating to the privacy of protected health information at 45 C.F.R. parts 160 and 164, as may be amended from time to time), both for statistical compilations, reports, research and all other purposes allowed under applicable laws. [REMAINDER OF PAGE INTENTIONALLY LEFT BLANK] Oceris, Inc / Page 4 of RelayHealth End User Sales Orders

5 ATTACHMENT A - BUSINESS ASSOCIATE AGREEMENT SECTION 1: DEFINITIONS Breach shall have the same meaning given to such term in 42 U.S.C (1) and 45 C.F.R Designated Record Set shall have the same meaning as the term designated record set in 45 C.F.R Electronic Health Record shall have same meaning given to such term in 42 U.S.C (5). Electronic Protected Health Information or Electronic PHI shall have the meaning given to such term under the Privacy Rule and the Security Rule, including, but not limited to, 45 C.F.R , as applied to the information that RelayHealth creates, receives, maintains or transmits from or on behalf of End User. Individual shall have the same meaning as the term individual in 45 C.F.R and shall include a person who qualifies as a personal representative in accordance with 45 C.F.R (g). Privacy Rule shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 C.F.R. Parts 160 and 162 and Part 164, Subparts A and E. Protected Health Information or PHI shall have the same meaning as the term protected health information in 45 C.F.R , as applied to the information created or received by RelayHealth from or on behalf of End User. Required by Law shall have the same meaning as the term required by law in 45 C.F.R Secretary shall mean the Secretary of the Department of Health and Human Services or his or her designee. Security Incident shall have the meaning given to such term in 45 C.F.R , but shall not include, (a) unsuccessful attempts to penetrate computer networks or servers maintained by RelayHealth and (b) immaterial incidents that occur on a routine basis, such as general pinging or denial of service attacks. and C. Security Rule shall mean the Security Standards at 45 C.F.R. Parts 160 and 162 and Part 164, Subparts A Unsecured PHI shall have the same meaning given to such term under 42 U.S.C (h), and guidance promulgated thereunder. Capitalized Terms. Capitalized terms used in this BAA and not otherwise defined herein shall have the meanings set forth in the Privacy Rule, the Security Rule, and the HITECH Act, which definitions are incorporated in this BAA by reference. SECTION 2: PERMITTED USES AND DISCLOSURES OF PHI 2.1 Uses and Disclosures of PHI Pursuant to the Sales Order. Except as otherwise limited in this BAA, RelayHealth may use or disclose PHI to perform functions, activities or services for, or on behalf of, End User as specified in the Sales Order, provided that such use or disclosure would not violate the Privacy Rule if done by End User. 2.2 Permitted Uses of PHI by RelayHealth. Except as otherwise limited in this BAA, RelayHealth may use PHI for the proper management and administration of RelayHealth or to carry out the legal responsibilities of RelayHealth. 2.3 Permitted Disclosures of PHI by RelayHealth. Except as otherwise limited in this BAA, RelayHealth may disclose PHI for the proper management and administration of RelayHealth, provided that the disclosures are Required by Law, or RelayHealth obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and will be used or further disclosed only as Required by Law or for the purpose for which it was disclosed to the person (which purpose must be consistent with the limitations imposed upon RelayHealth pursuant to this BAA), and that the person agrees to notify RelayHealth of any instances of which it is aware in which the confidentiality of the information has been breached. RelayHealth may use PHI to report violations of law to appropriate federal and state authorities, consistent with 45 C.F.R (j)(1). 2.4 Data Aggregation. Except as otherwise limited in this BAA, RelayHealth may use PHI to provide Data Aggregation services as permitted by 45 C.F.R (e)(2)(i)(B), including use of PHI for statistical compilations, reports, research and all other purposes allowed under applicable law. Oceris, Inc / Page 5 of RelayHealth End User Sales Orders

6 2.5 De-identified Data. RelayHealth may create de-identified PHI in accordance with the standards set forth in 45 C.F.R (b) and may use or disclose such de-identified data for any purpose. 2.6 Disclosure Pursuant to Authorization. Without limiting the generality of the foregoing, RelayHealth reserves the right at its sole discretion to disclose an Individual s PHI in response to and in accordance with a valid authorization executed by such individual that meets the requirements set forth in the Privacy Rule. SECTION 3: OBLIGATIONS OF RELAYHEALTH 3.1 Appropriate Safeguards Privacy of PHI. RelayHealth will develop, implement, maintain, and use appropriate safeguards to prevent use or disclosure of PHI other than as provided for by the Sales Order and this BAA. The safeguards must reasonably protect PHI from any intentional or unintentional use or disclosure in violation of the Privacy Rule and this BAA, and limit incidental uses or disclosures made pursuant to a use or disclosure otherwise permitted by this BAA Security of PHI. RelayHealth will develop, implement, maintain, and use appropriate administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of Electronic PHI, as required by the Security Rule. Commencing on February 17, 2010, RelayHealth will comply with the provisions of 45 C.F.R , , and relating to implementation of administrative, physical and technical safeguards with respect to Electronic PHI in the same manner that such provisions apply to a HIPAA covered entity. RelayHealth will also comply with any additional security requirements contained in the HITECH Act that are applicable to a business associate. 3.2 Reporting of Improper Use or Disclosure, Security Incident or Breach. RelayHealth will report to End User any use or disclosure of PHI not provided for by the Sales Order of which it becomes aware. RelayHealth will report to End User any Security Incident of which it becomes aware. RelayHealth will notify End User of any Breach of Unsecured PHI as soon as practicable, and no later than 30 days after discovery of such Breach. RelayHealth s notification to End User of a Breach will include: (a) the identification of each individual whose Unsecured PHI has been, or is reasonably believed by RelayHealth to have been, accessed, acquired or disclosed during the Breach; and (b) any particulars regarding the Breach that End User would need to include in its notification, as such particulars are identified in 42 U.S.C and 45 C.F.R RelayHealth s Agents. RelayHealth will ensure that any agent or subcontractor to whom it provides PHI received from, or created or received by RelayHealth on behalf of End User, agrees to restrictions and conditions that are substantially similar to those that apply through this BAA to RelayHealth with respect to such PHI. RelayHealth will ensure that any agent, including a subcontractor, to whom it provides Electronic PHI agrees to implement reasonable and appropriate safeguards to protect such information. 3.4 Access to PHI. The parties do not intend for RelayHealth to maintain any PHI in a Designated Record Set for End User. To the extent RelayHealth possesses PHI in a Designated Record Set, RelayHealth agrees to make such information available to End User pursuant to 45 C.F.R and 42 U.S.C (e)(1), as applicable, within ten business days of RelayHealth s receipt of a written request from End User; provided, however, that RelayHealth is not required to provide such access where the PHI contained in a Designated Record Set is duplicative of the PHI contained in a Designated Record Set possessed by End User. If an Individual makes a request for access pursuant to 45 C.F.R directly to RelayHealth, or inquires about his or her right to access, RelayHealth will direct the Individual to End User. 3.5 Amendment of PHI. The parties do not intend for RelayHealth to maintain any PHI in a Designated Record Set for End User. To the extent RelayHealth possesses PHI in a Designated Record Set, RelayHealth agrees to make such information available to End User for amendment pursuant to 45 C.F.R within 20 business days of RelayHealth s receipt of a written request from End User. If an Individual submits a written request for amendment pursuant to 45 C.F.R directly to RelayHealth, or inquires about his or her right to amendment, RelayHealth will direct the Individual to End User. 3.6 Documentation of Disclosures. RelayHealth agrees to document such disclosures of PHI and information related to such disclosures as would be required for End User to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 C.F.R , and 42 U.S.C (c), as applicable. RelayHealth will document, at a minimum, the following information ( Disclosure Information ): (a) the date of the disclosure; (b) the name and, if known, the address of the recipient of the PHI; (c) a brief description of the PHI Oceris, Inc / Page 6 of RelayHealth End User Sales Orders

7 disclosed; (d) the purpose of the disclosure that includes an explanation of the basis for such disclosure; and (e) any additional information required under the HITECH Act and any implementing regulations. 3.7 Accounting of Disclosures. RelayHealth agrees to provide to End User, within 20 business days of RelayHealth s receipt of a written request from End User, information collected in accordance with Section 3.6 of this BAA, to permit End User to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 C.F.R , and 42 U.S.C (c), as applicable. 3.8 Governmental Access to Records. RelayHealth will make its internal practices, books and records relating to the use and disclosure of PHI received from, or created or received by RelayHealth on behalf of, End User available to the Secretary for purposes of the Secretary determining End User s compliance with the Privacy Rule and the Security Rule. 3.9 Mitigation. To the extent practicable, RelayHealth will cooperate with End User s efforts to mitigate a harmful effect that is known to RelayHealth of a use or disclosure of PHI not provided for in this BAA Minimum Necessary. RelayHealth will request, use and disclose the minimum amount of PHI necessary to accomplish the purpose of the request, use or disclosure, in accordance with 42 U.S.C (b) and regulations promulgated thereunder Limitation on Marketing. RelayHealth may use and disclose PHI for marketing purposes only as expressly directed by End User, and in accordance with 42 U.S.C (a). RelayHealth will not use or disclose PHI for fundraising purposes Limitation on Sale of Electronic Health Records and PHI. RelayHealth will comply with the prohibition on the sale of Electronic Health Records and PHI set forth in 42 U.S.C (d) HITECH Act Applicability. RelayHealth acknowledges that enactment of the HITECH Act amended certain provisions of HIPAA in ways that now directly regulate, or will on future dates directly regulate, RelayHealth under the Privacy Rule and Security Rule. To the extent not referenced or incorporated herein, requirements applicable to RelayHealth under the HITECH Act are hereby incorporated by reference into this BAA. RelayHealth agrees to comply with applicable requirements imposed under the HITECH Act, as of the effective date of each such requirement. SECTION 4: OBLIGATIONS OF END USER 4.1 Notice of Privacy Practices. End User will notify RelayHealth of any limitation(s) in its notice of privacy practices in accordance with 45 C.F.R , to the extent that such limitation may affect RelayHealth s use or disclosure of PHI. End User will provide such notice no later than 15 days prior to the effective date of the limitation. 4.2 Notification of Changes Regarding Individual Permission. End User will notify RelayHealth of any changes in, or revocation of, permission by an Individual to use or disclose PHI, to the extent that such changes may affect RelayHealth s use or disclosure of PHI. End User will provide such notice no later than 15 days prior to the effective date of the change. End User will obtain any consent or authorization that may be required by the Privacy Rule, or applicable state law, prior to furnishing RelayHealth with PHI. 4.3 Notification of Restrictions to Use or Disclosure of PHI. End User will notify RelayHealth of any restriction to the use or disclosure of PHI that End User has agreed to in accordance with 45 C.F.R or 42 U.S.C (a), to the extent that such restriction may affect RelayHealth s use or disclosure of PHI. End User will provide such notice no later than 15 days prior to the effective date of the restriction. If RelayHealth reasonably believes that any restriction agreed to by End User pursuant to this Section may materially impair RelayHealth s ability to perform its obligations under the Sales Order or this BAA, the parties will mutually agree upon any necessary modification of RelayHealth s obligations under such agreements. 4.4 Permissible Requests by End User. End User will not request RelayHealth to use or disclose PHI in any manner that would not be permissible under the Privacy Rule, the Security Rule or the HITECH Act if done by End User, except as permitted pursuant to the provisions of Sections 2.2, 2.3, 2.4, 2.5 and 2.6 of this BAA. Oceris, Inc / Page 7 of RelayHealth End User Sales Orders

8 SECTION 5: TERM AND TERMINATION 5.1 Term. The term of this BAA will commence as of the Effective Date of the Sales Order, and will terminate when all of the PHI provided by End User to RelayHealth, or created or received by RelayHealth on behalf of End User, is destroyed or returned to End User or, if it is infeasible to return or destroy PHI, protections are extended to such information, in accordance with Section Termination for Cause. Upon either party s knowledge of a material breach by the other party of this BAA, such party will provide written notice to the breaching party detailing the nature of the breach and providing an opportunity to cure the breach within 30 business days. Upon the expiration of such 30 day cure period, the nonbreaching party may terminate this BAA and, at its election, the Sales Order, if cure is not possible. 5.3 Effect of Termination Except as provided in Section 5.3.2, upon termination of the Sales Order or this BAA for any reason, RelayHealth will return or destroy all PHI received from End User, or created or received by RelayHealth on behalf of End User, and will retain no copies of the PHI. This provision will apply to PHI that is in the possession of subcontractors or agents of RelayHealth If it is infeasible for RelayHealth to return or destroy the PHI upon termination of the Sales Order or this BAA, RelayHealth will: (a) extend the protections of this BAA to such PHI; (b) limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as RelayHealth maintains such PHI; and (c) never disclose such PHI to another RelayHealth client or third party unless such information has been deidentified in accordance with the standards set forth in 45 C.F.R (b). SECTION 6: SURVIVAL The respective rights and obligations of RelayHealth under Section 5.3 of this BAA will survive the termination of the BAA and the Sales Order. SECTION 7: EFFECT OF BAA In the event of any inconsistency between the provisions of this BAA and the Sales Order, the provisions of the BAA will control. In the event of inconsistency between the provisions of this BAA and mandatory provisions of the Privacy Rule, the Security Rule or the HITECH Act, as amended, or their interpretation by any court or regulatory agency with authority over RelayHealth or End User, such interpretation will control; provided, however, that if any relevant provision of the Privacy Rule, the Security Rule or the HITECH Act is amended in a manner that changes the obligations of RelayHealth or End User that are embodied in terms of this BAA, then the parties agree to negotiate in good faith appropriate non-financial terms or amendments to this BAA to give effect to such revised obligations. Where provisions of the BAA are different from those mandated in the Privacy Rule, the Security Rule, or the HITECH Act, but are nonetheless permitted by such rules as interpreted by courts or agencies, the provisions of the BAA will control. SECTION 8: GENERAL If any part of a provision of this BAA is found illegal or unenforceable, it will be enforced to the maximum extent permissible, and the legality and enforceability of the remainder of that provision and all other provisions of this BAA will not be affected. All notices relating to the parties legal rights and remedies under this BAA will be provided in writing to a party, will be sent to its address set forth in the Sales Order, or to such other address as may be designated by that party by notice to the sending party, and will reference this BAA. This BAA may be modified, or any rights under it waived, only by a written document executed by the authorized representatives of both parties. Nothing in this BAA will confer any right, remedy, or obligation upon anyone other than End User and RelayHealth. This BAA is the complete and exclusive agreement between the parties with respect to the subject matter hereof, superseding and replacing all prior agreements, communications, and understandings (written and oral) regarding its subject matter. Oceris, Inc / Page 8 of RelayHealth End User Sales Orders